ZoneMinder CVE-2026-102608

Exploitation requires two authenticated prerequisites, not a default-reachable path: (1) an account with monitor-create or monitor-edit permission to store a monitor Name containing shell metacharacters, and (2) a user with Events View permission who exports that monitor's events, invoking downloadEvents(). The stored Name must reach the ffmpeg concatenation command and the tar/zip archive command, where it breaks out of the manual single-quote wrapping. Limiting factors that reduce real-world risk: the attacker needs a privileged (monitor-edit) role, the payload only fires when a victim performs the export action (user interaction), and only ZoneMinder versions prior to 1.38.3 are affected. It is not exploitable unauthenticated or against a patched install.

This is a genuine high-priority issue for ZoneMinder operators running versions prior to 1.38.3, but it is not a mass-exploitable internet worm candidate. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H = 9.0) is internally consistent with the description: network-reachable web UI, low complexity, but requiring authenticated privileges (PR:L - a monitor-create/monitor-edit role) and user interaction (UI:R - a user with Events View permission must export the monitor's events). The scope change (S:C) and triple-high impact reflect that injected commands run as the web server user, a different privilege context. No EPSS score, no CISA KEV listing, and no explicit POC flag were supplied in the input, so exploitation status is 'no public exploit identified at time of analysis' - though a technical writeup reference ('two-sinks-one-shell') suggests the mechanism is publicly documented, which typically shortens time-to-exploit. The key tempering factor missing from the raw 9.0 is that this is a stored/second-order injection gated behind two authenticated roles and a victim-triggered export, so it is far more realistic as a privilege-escalation / insider or multi-user-tenant attack than as unauthenticated RCE. The CWE-78 root cause (manual single-quote wrapping instead of escapeshellarg()) is confirmed directly by the vendor patch diff.

An attacker holding a ZoneMinder account with monitor-create or monitor-edit permission sets a monitor's Name to a string containing shell metacharacters (e.g. breaking out of the manual single quotes). When any user with Events View permission later exports that monitor's events, downloadEvents() passes the stored Name into both the ffmpeg concat command and the tar/zip archive command, where the payload escapes the quoting and executes arbitrary commands as the web server user. The technique is publicly described in a blog writeup ('two-sinks-one-shell'), but no confirmed weaponized exploit code or active exploitation is indicated in the provided data.